What is the difference between a vulnerability assessment and a penetration test?

A vulnerability assessment systematically identifies and prioritizes security weaknesses without actively exploiting them. A penetration test goes further: testers actively attempt to exploit identified vulnerabilities to determine whether an attacker could gain unauthorized access or escalate privileges. GDF Miami offers both services, and the appropriate choice depends on organizational risk tolerance, compliance requirements, and security maturity.

How often should penetration testing be done?

Most security frameworks and regulations recommend annual penetration testing at minimum, with additional testing after significant infrastructure changes, application releases, or security incidents. PCI DSS requires external penetration testing at least annually and after significant changes. Organizations with higher risk profiles or active development programs benefit from more frequent testing.

Does a penetration test disrupt business operations?

GDF's penetration tests are carefully scoped and scheduled to minimize operational impact. Most external and web application tests are conducted without any disruption to normal operations. For internal network tests, GDF Miami coordinates with IT staff to schedule intensive testing activities during low-traffic periods. All test parameters, including excluded systems and emergency stop procedures, are agreed upon before testing begins.

What compliance frameworks require penetration testing?

PCI DSS requires annual penetration testing for cardholder data environments. HIPAA's Security Rule requires periodic security testing of technical safeguards. SOC 2 service organizations typically include penetration testing in their control evidence. CMMC Level 2 and above require penetration testing for organizations handling Controlled Unclassified Information. Many cyber insurance underwriters now require annual penetration test results as a condition of coverage.

Cybersecurity

Cybersecurity Testing and Breach Response for Miami and Beyond

We test networks and applications the way an attacker actually would, and when a breach lands we respond with the same forensic rigor we bring to a courtroom. Findings come with reproduction steps, remediation guidance and documentation that counsel, insurers and regulators can use.

Cybersecurity testing methodology: reconnaissance, discovery, exploitation, post-exploitation and reporting

What Cybersecurity Testing Actually Delivers

A useful engagement produces a small number of concrete outputs the client can act on:

An exploitable-finding list, not a scanner report. Every finding is manually verified, reproduced with proof-of-concept steps, and rated by the actual impact an attacker with that access could achieve, not by a generic CVSS number.
Remediation sequenced by consequence. Fix the two dozen findings that could reach regulated data or business-critical systems first. Address the rest in the normal patch cycle. The report tells the client which is which.
Reproducible test cases engineering can run. When a defect is fixed, the same test that surfaced it re-runs cleanly. The closure record is a documented artifact, not a hope.
Evidence for regulators, insurers and counsel. The report is written to be attached to an insurance renewal, a regulatory examination response, or a breach-response record without additional translation.
Guidance the engineering team can implement without a consultant. Every finding comes with remediation the team’s own developers can execute, not a follow-on engagement.

How We Test

Testing is scoped in writing before it starts. Attack surface, target systems, authorized test windows, safe-testing constraints for production environments and rules of engagement are all documented so the engineering team, the security team and any third-party operator know what to expect.

Network penetration testing

External and internal, unauthenticated and credentialed. Reconnaissance of exposed infrastructure, enumeration of services and versions, exploitation of misconfiguration and known-vulnerable software, and post-exploitation to establish the actual impact of an initial foothold: lateral movement paths, credential harvesting, and reach into segments the initial access should not have exposed.

Application security testing

Web applications, APIs and mobile clients tested against the OWASP Top 10 and language-specific weakness classes: authentication and session handling, authorization boundary enforcement, input handling and injection, business-logic abuse, cryptographic implementation, and API-specific abuse patterns. Testing runs authenticated and unauthenticated, across the user roles that actually exist in the application.

Cloud and identity testing

AWS, Azure and Google Cloud configuration review, identity and access management analysis, and testing of the trust relationships between cloud tenants and on-premises systems. For clients running federated identity, SSO configuration review and abuse testing are part of the standard scope.

Red team engagements

Goal-oriented adversary simulation against a defined objective (reach the crown-jewel data, achieve domain-admin, obtain the ability to move funds), scoped and executed with the security team’s awareness or blind to it depending on the engagement design. Focused on the client’s ability to detect and respond, not just the surface exposed.

Case in point

A pre-launch pentest that caught an authentication bypass

A Miami fintech was two weeks from launching a new production authentication flow. The internal security team had reviewed the design and QA had signed off on the functional tests. Before shipping, the team retained us for an adversarial pentest of the flow end to end.

We approached the authentication service the way an attacker would: reconnaissance against the exposed endpoints, session and token handling under abuse, timing analysis on the credential validation path, and abuse of the multi-factor fallback options. Within the engagement window we surfaced a token-binding gap that would have allowed a valid session token issued to one user to be replayed against another account for a defined time window under specific conditions. The finding was reproducible, documented with proof-of-concept requests, and delivered with remediation guidance the engineering team could act on.

Remediation went in before launch. The production flow shipped without the defect, and the closure re-test we ran confirmed the fix held under the same attack conditions that had surfaced the finding.

Breach Response

When an incident lands, the first hours matter. Our incident response team is available around the clock and works alongside the client’s security team, outside counsel and insurance carrier from the first call.

Containment. Isolating affected systems, cutting attacker access without destroying the evidence we will later need to characterize the incident.
Forensic preservation. Volatile memory capture, disk imaging, log preservation and cloud-tenant export while the artifacts are still available. Chain of custody documented from the first touch.
Scope determination. The threshold question in every incident, for Florida’s own notification statute, HIPAA, PCI or an insurance claim, is what data was actually reached. We work backwards from the evidence to a defensible answer, not an assumption.
Attribution and root cause. Documenting how the attacker got in, what they did, and what they took. The report supports both the immediate response and the post-incident hardening.
Coordinated response. Working with retaining counsel on the legal side, with the carrier on the coverage side, and with regulators where a notice or filing is required.

Incident engagements produce the same two-layer report our testing engagements do: technical detail engineering can act on, and a plain-language narrative counsel and executives can hand up the chain.

Where Our Miami Cyber Practice Runs Deepest

Fintech, crypto and digital-asset companies

Payments platforms, money service business infrastructure, custody and exchange systems, and the smart contracts behind them. A defect in this space is not a bug report; it is a loss of customer funds and a regulatory problem. Pre-launch pentests, ongoing assessment programs and incident response for the Miami fintech cluster.

FAA and EASA airworthiness penetration testing

Aviation software and connected avionics tested against the airworthiness cybersecurity framework applicable to the certification pathway (FAA AC 119-1, EASA ED-202A / ED-203A, DO-326A / DO-356A). Testing runs against the evidence expectations of the certification authority so the deliverable slots into the airworthiness submission rather than sitting alongside it.

Traffic and infrastructure protection testing

Traffic management systems, connected infrastructure, tolling and access control tested with the same discipline as any high-consequence environment. Passive discovery first, exploitation only in authorized isolation, and reporting sequenced against the operational calendar the site actually runs on.

Hospitality, resort and cruise-line properties

Card-present environments combining POS, guest Wi-Fi, property management systems and vendor VPNs. Testing focused on reachability of the cardholder environment from adjacent segments and on the vendor paths that most operators do not have full visibility into.

Regional hospital systems and healthcare

HIPAA-scoped testing against clinical and administrative systems, with reporting mapped to HHS OCR audit protocol elements so findings support the compliance work the organization already does.

Cross-border wire fraud and business email compromise

Response and prevention work for South Florida financial firms, title agencies and law offices dealing with fraudulent wire instructions. We document the intrusion timeline, trace the funds to the extent the routing evidence allows, and coordinate with counsel on emergency-relief filings.

Compliance and Regulatory Support

Findings are structured to map into the compliance frameworks the client already operates under:

PCI DSS: testing scoped and reported against the applicable requirements; coordination with a PCI Forensic Investigator (PFI) where an incident triggers card-brand engagement.
HIPAA: findings mapped to HHS OCR audit protocol elements and to the Security Rule technical safeguards.
Florida notification obligations: incident assessment framed against Florida’s own notification statute so counsel can make the determination on documented facts.
SOX and financial-services regulation: control testing and IT general controls examination for public-company clients and regulated financial institutions.
SOC 2 and ISO 27001: pre-audit assessment and remediation support against the applicable trust services criteria or Annex A controls.

Standards and Standing

Our testers hold OSCP, OSWE, GPEN, GWAPT, GXPN and CISSP among other credentials. Testing methodology follows NIST SP 800-115, PTES, OWASP Testing Guide and PCI DSS-approved testing procedures where the environment is in scope. Incident response follows NIST SP 800-61 Rev. 2. Every engagement is documented so the record survives a challenge by an opposing expert, an auditor or a regulator.

Last updated: September 4, 2026

Test Before an Attacker Does

Whether the goal is a targeted pentest of a new production system, a broader assessment program, or urgent breach response, the earlier the conversation the more useful the engagement.

Request Consultation Call (786) 219-1210